[jeremy]

basecamp-sdk v0.29.1 adds in-band renewal of the event stream (basecamp/basecamp-sdk#1044). When bc3 puts a stream deadline in the welcome, the connector renews the socket over the open connection about three minutes before that deadline. A held agent stream then stays up instead of dropping and reconnecting once an hour.

The pin

This pins github.com/basecamp/basecamp-sdk/go v0.29.1 (0b66bbc3). v0.29.0 never published a Go module: its Release Go SDK run failed on a flaky ETag-cache race test, so go/v0.29.0 was never tagged. basecamp/basecamp-sdk#1051 fixed the test's setup, and v0.29.1 shipped it. Between v0.29.0 and v0.29.1 the only Go changes are that test (go/pkg/basecamp/etag_doer_test.go) and the version stamp, so the SDK code this PR builds against is the code #1044 shipped.

The branch was rebuilt on the release pin. It replaces the earlier commit that pinned 5908bb54's pseudo-version, so no commit here pins anything but v0.29.1.

• scripts/bump-sdk.sh v0.29.1 updated go.mod, go.sum and internal/version/sdk-provenance.json.
• scripts/sync-mcp-model.sh at v0.29.1 left behavior-model.json and openapi.json byte-for-byte unchanged from v0.28.1. Only internal/mcpserver/model/PROVENANCE.json moves.
• make update-nix-hash updated the vendorHash in nix/package.nix and built the flake with it.

The connector

intake logs every socket lifecycle callback the SDK has, except the three #1044 adds. Without them, a renewal that gave up would show up only as an unexplained remote disconnect at the deadline. intake now logs these too:

• StreamDeadline (info): the deadline the welcome advertised.
• Renewed (info): the new deadline.
• RenewFailed (warn): the kind of failure, from the SDK's closed list (refused, no_reply, mint_failed, invalid_reply), and whether it will be retried. If it won't, the line says the server's lease will close the socket and the connector will reconnect as it does after any disconnect.

Nothing changes in connect status or connect doctor:

• status reads the ledger, and by design it holds no feed-socket state. ConnectionStatus says: "It is not the feed socket's state, which intake does not report." Renewal belongs to one socket and is short-lived. It never ends the feed and decides nothing: a renewal that gives up falls back to the reconnect and catch-up the connector already does. Showing it in status would take a ledger write for every renewal, plus a migration, for something no person has to act on.
• doctor runs apart from the running connector and opens no socket, so it can't see what a welcome advertises.
• bc3 doesn't advertise a deadline yet (basecamp/bc3#14143 is still open), so none of these three callbacks fires in production until it ships.

The token path needs no change. A renewal mints its ticket the same way the connect does, through feedTokens and auth.Manager.AccessToken, which refreshes the token once it is within auth.RefreshWindow (5 minutes) of expiry. A renewal is due 3 minutes ± 30 s before the deadline, so its mint gets the later token the server requires.

Verification

• make check passed on Linux (thelio) at 177b625, the head.
• make update-nix-hash updated the vendorHash and built the flake with it.
• TestAnInBandRenewalReachesTheConnectorLog runs a real renewal through intake's feed: a welcome with a deadline, then subscribe, catch-up, the renew command and the renewed reply. It checks that both log lines carry their deadlines and that the renewal's ticket stays out of the log.
• TestAFailedRenewalSaysWhetherItIsRetriedOrLeftToTheLease checks the retry line and the give-up line.
• With the observer change reverted, both tests fail. With it, both pass 3 of 3 times under -race, at the head.

[Copilot]

🔵 Needs a closer look

The documented merge prerequisite remains replacing the temporary SDK pin with the Go release tag and updating and validating the associated hashes.

No open issues 🎉

What changed in this PR

Updates the Basecamp SDK to a temporary revision supporting in-band event-stream renewal and adds connector logging for renewal lifecycle events.

Changes:

• Updates the SDK pin, provenance records, module checksums, and Nix vendor hash.
• Logs advertised deadlines, successful renewals, and renewal failures with retry or reconnect outcomes.
• Adds tests for renewal logging, failure messages, and keeping renewal tickets out of logs.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
nix/​package.nix	Updates the vendor hash for the SDK bump.
internal/​version/​sdk-provenance.json	Records the temporary SDK version and revision.
internal/​mcpserver/​model/​PROVENANCE.json	Updates the model source revision and tag.
internal/​connector/​renewal_log_test.go	Tests renewal logs and ticket secrecy.
internal/​connector/​intake.go	Adds renewal lifecycle logging callbacks.
go.sum	Updates SDK module checksums.
go.mod	Pins the SDK revision containing in-band renewal.

_{Review effort: Balanced}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T18:41:15.906356Z	177b625	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-26T18:42:38.522557Z	177b625	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 4920add070

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 4920add070

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[Copilot]

🟢 Approved

The dependency metadata is consistent, renewal callbacks match the SDK contract, and focused regression coverage supports the logging changes with no blocking issues identified.

No open issues 🎉

_{Review effort: Balanced}